For our Checking In feature, we reach out to partners and heads of practice across CEE to learn how specific practice areas are faring in their jurisdictions. For this piece, we asked firm Labor experts: Have whistleblowing regulations been implemented in your jurisdiction and would you advise companies to use an external solution or an in-house one? Why?
Czech Republic
In the Czech Republic, whistleblowing regulations were implemented by Act No. 171/2023 Coll., effective from August 1, 2023. The obligation to implement an internal reporting system applies, among others, to employers who employ at least 50 employees as of January 1 of the relevant calendar year. Each company must implement its own reporting system; sharing of the system is allowed under the same rules as under the EU regulation. It is also possible to outsource the system from an external provider.
We recommend opting for the external provider of the system and for an external designated person. Alternatively, an external provider with an in-house designated person who is not involved in employee decision-making processes directly regarding employees, external providers, or other potential whistleblowers, e.g., a compliance manager.
The primary reason is to mitigate the risk of retaliatory actions. If the company (the persons making the respective decisions) doesn’t know the identity of the whistleblower, it cannot be motivated by the whistleblower’s report to take actions that could be later qualified as (or argued to be) retaliatory. This makes it easier for companies to fight potential claims arising from alleged retaliation.
Another reason for choosing an external provider is the complexity of the reports, which can require using external advisors to successfully handle the report, anyway. In some cases, there is also a risk that a fully internally operated whistleblowing system may not be sufficiently objective and effective, which raises the risk of the whistleblower going public or raising various claims as well as the risk of administrative penalties. External providers are also expected to have broader experience in handling the reports and managing the system. As a result, their solutions are likely to be sophisticated and effective.
However, prior to choosing the external provider, we recommend vetting them and the system itself, choosing someone trustworthy, and carefully structuring the relationship as they will have insight into internal matters of the company.
Radim Dolezal and Lucie Kucerova, Senior Associates, Legalite
Hungary
The new Hungarian whistleblowing law came into effect on July 24, 2024. The regulation allows the whistleblowing system to be operated by a designated, impartial internal person or organizational unit within the company, or by an external service provider. In the case of hiring an external service provider, a contract can be made with a whistleblower protection lawyer or another external organization to operate the whistleblowing system. The operation of the system includes receiving reports (both written and oral), communicating with whistleblowers, informing them, investigating the report, and providing feedback on the outcome.
Both internal and external solutions have their advantages, and companies required to establish a whistleblowing system should consider choosing the structure that best fits their organizational needs. If the system is operated by an internal person or unit, greater integration of processes can be ensured, and the company has more control over the process. Efficiency considerations also play a role, as in this case, the person investigating the misconduct is familiar with the company's internal structure and operations and may be more accessible and trustworthy to employees.
On the other hand, an external solution provides increased anonymity: employees can blow the whistle without directly revealing their identity to their employer. Communicating the report to an independent third party rather than the employer can enhance the whistleblower's sense of security. Additionally, the independence of the external organization from the company ensures a neutral, unbiased perspective necessary for the investigation and subsequent actions.
It is also important to note that corporate groups need to establish separate whistleblowing systems for their subsidiaries; a central group-level system is insufficient. According to the expert group's position on the EU directive, the subsidiary's system cannot be operated by the parent company's employees or units, as they are considered neither internal (within the subsidiary) nor external. Therefore, the subsidiary's whistleblowing system must be operated by an employee or unit within the subsidiary or by an organization outside the corporate group.
Andrea Belenyi, Partner and Head of Regulatory, and Luca Bader, Associate, VJT & Partners
Latvia
Adopted in early 2022, the Whistleblowing Law was a major step towards increasing corporate responsibility and transparency. The Law mandates that all governmental organizations and private businesses with more than 50 employees must establish a whistleblower system. However, the external system may only be used if the outsourced entity can guarantee independence, confidentiality, data protection, and secrecy.
Normally, when advising clients, we emphasize the following:
Confidentiality and Trust: External solutions can increase employees' confidence in the process since third-party service providers are more likely to be impartial. Employees have higher trust that the whistleblower’s identity will indeed be protected by an outsider and that the reports will be handled discreetly.
Specialized Expertise: Whistleblowers' reports can cover a wide range of issues, from ethical and criminal matters to even competition law. A lack of relevant expertise may result in an improper assessment of the risks arising from the reported issues. In other instances, following complex legal procedures is mandatory. The necessary expertise is more likely to be brought by external advisors.
Cost Considerations: Hiring external advisors triggers additional, sometimes significant, costs. However, internal systems may eventually prove to be more costly if new technological solutions, such as protecting whistleblowers' identities, are needed and ready-made technical solutions are not available. Additionally, in-house personnel in charge of the whistleblower system normally need ongoing training, which does not come without a cost. Therefore, outsourcing to an external service provider often proves to be a more economical option.
Organizational Control and Response Efficiency: Internal systems offer more efficient and timely reactions to the whistleblower reports received. In some cases, time is of the essence to properly address the reported offenses, thereby preventing additional harm to the clients and other employees.
Therefore, our primary suggestion for Latvian businesses is to take advantage of external reporting services. This way, they can provide a secure avenue for employees to report any misconduct or unethical behavior without fear of reprisal, thereby promoting legal compliance and cultivating a corporate culture that values transparency and ethical conduct.
Julija Jerneva, Partner, Vilgerts
Lithuania
In Lithuania, the Law on the Protection of Whistleblowers, effective from January 1, 2019, marks a significant step towards enhancing transparency and accountability in both the public and private sectors. The regulation aims to create a secure environment for individuals to report breaches confidentially and without repercussions.
Under the law, companies must establish internal reporting channels, which can be managed either in-house or by third-party service providers. Companies are also required to implement whistleblowing procedures and designate a responsible person or unit for investigations. Specific subject areas for reporting are defined by the law.
In Lithuania, the law prescribes that internal channels for the reporting of breaches must ensure the confidentiality of whistleblowers. These channels are mandatory in all public or municipal institutions, private companies with 50 or more employees, and companies operating in specific sectors regardless of the number of employees.
When deciding between an external or internal whistleblowing solution, several factors must be considered. Choosing an in-house whistleblowing mechanism allows companies to directly oversee the process, ensuring alignment with company protocols and values. However, this may lead to potential conflicts of interest or bias, especially if senior management is involved. Additionally, companies might lack the necessary expertise to handle complex cases effectively, risking mishandling and legal consequences.
On the other hand, an external whistleblowing solution provides an independent and impartial platform for employees and third parties to report concerns. This approach can build trust in the whistleblowing mechanism, as it ensures that reports will be investigated objectively by a neutral third party. External providers often have more experience in managing whistleblowing cases and ensuring compliance with relevant legislation. However, if a company opts for an external solution, it must carefully evaluate potential providers and select one with a proven track record of reliable service.
Ultimately, companies should consider their size, resources, and specific needs when choosing a whistleblowing solution. Developing robust whistleblowing systems and ensuring the fair and efficient handling of reports are essential for protecting whistleblowers' rights and maintaining corporate integrity.
Loreta Andziulyte, Partner, Ecovis ProventusLaw
North Macedonia
Whistleblowing is a critical mechanism for ensuring transparency and accountability within organizations. In North Macedonia, whistleblowing regulations have been established to protect individuals who report illegal activities or misconduct.
North Macedonia has implemented whistleblowing regulations under the Law on Whistleblower Protection, enacted in 2015 and subsequently amended in 2018. This law provides a framework for protecting whistleblowers against retaliation and outlines procedures for reporting misconduct. It applies to both public and private sectors, ensuring that individuals can report concerns anonymously and confidentially.
Protected reporting, within the meaning of the Law on the Protection of Whistleblowers, is defined as reporting that, in accordance with the law, conveys a reasonable suspicion or knowledge that a punishable or otherwise illegal or impermissible act has been committed, is being committed, or is likely to be committed, thereby violating or endangering the public interest.
Internal Protected Reporting is performed by the whistleblower within the institution or legal entity where there is suspicion or knowledge that a punishable act, or another illegal or impermissible action, which violates or endangers the public interest, has been committed, is being committed, or will be committed. Protected internal reporting in the private sector is regulated by an internal act of the legal entity with at least 10 employees.
The whistleblower can also report outside the institution or legal entity where the reporting is done, and such reporting will be considered protected external reporting, but only under conditions prescribed by law. Institutions competent for external reporting include the Ministry of Internal Affairs of the Republic of North Macedonia, the State Commission for the Prevention of Corruption, the Ombudsman of the Republic of North Macedonia, and the Public Prosecutor's Office.
In accordance with the legal framework in North Macedonia, there is currently no provision for an external mechanism designated to handle whistleblower disclosures or corporate reporting on behalf of companies. However, the law does outline a process for external reporting, whereby disclosures are made directly to the relevant authorities specified in the preceding paragraph.
Artan Memishi, Partner, Law Office Aleksov-Memishi
Romania
In Romania, the implementation of Directive 2019/1937 of the European Parliament and the Council, which focuses on the protection of individuals who report breaches of EU law, has been achieved through the enactment of Law 361/2022. This law specifically addresses the protection of whistleblowers in the public interest, commonly referred to as the Whistleblower Law.
From a practical standpoint, we believe that utilizing the services of a qualified external provider represents a significantly safer and more effective solution for managing reports covered under the Whistleblower Law. One of the primary advantages of this approach is the assurance of a high level of independence and transparency. In contrast to internal organizational processes, an external provider can offer an unbiased and objective analysis of reports, thereby minimizing the risk of subjective interpretation and potential conflicts of interest.
Furthermore, engaging a qualified external provider is advantageous from a cost-efficiency perspective. Such providers already possess the necessary infrastructure, including advanced IT equipment and specialized knowledge, which are critical for effectively managing whistleblower reports. These providers are experienced in handling the complexities associated with internal organization and have expertise in related areas such as data protection. This pre-existing capability allows for more efficient logistical organization, reducing the need for companies to invest in developing similar internal resources.
Additionally, opting for an external provider can result in substantial cost savings for the employer. Specifically, it eliminates the need to hire additional personnel dedicated to managing whistleblower reports, thereby avoiding the associated expenses of salaries and training. The expertise and resources provided by a qualified external provider ensure that the organization can comply with legal requirements without the financial burden of expanding its workforce.
In summary, the use of a qualified external provider for managing whistleblower reports under the Whistleblower Law offers numerous benefits, including enhanced independence and transparency, cost efficiency, and the elimination of the need for additional human resources. This approach not only ensures compliance with the law but also supports the organization's overall operational efficiency and integrity.
Catalin Micu, Partner, Zamfirescu Racoti Vasile & Partners
Slovakia
The whistleblowing regulations have already been implemented in our jurisdiction in Slovakia. Whistleblowers are protected by the Whistleblower Protection Act which has been amended several times, i.e., harmonized with the EU law.
According to the law, any employer in Slovakia employing more than 50 employees (plus several exceptions) must introduce an internal whistleblowing system, i.e., a system ensuring the verification of notifications. The person responsible for verifying notifications can be an employee or a group of employees within a specific organizational unit of the employer. From 2023, it is also possible to delegate some tasks to external responsible persons, within the scope of receiving and confirming the notifications. Employers (who are not public authorities) employing less than 250 employees can also entrust externally responsible persons with verifying the notifications based on the contract with the employer.
The Whistleblower Protection Act has also established the Whistleblower Protection Office, an independent, nationwide state institution in Slovakia that protects the rights of whistleblowers. Currently, the Office is quite active in Slovakia and provides a wide range of whistleblower assistance and education. The Office offers a free helpline for whistleblowers, but also employers.
The evaluation of whether an external solution of verification of notifications or an in-house one is more suitable for the employer also depends on the size of the company/organization. In the case of smaller employers, external resources are used more often. On the contrary, in the case of larger employers, it is often more worthwhile to invest in an internal system, which requires more effort, especially in the initial setup and running of the system.
There are pros and cons to both internal and external solutions to whistleblowing. Therefore, it is not possible to say in general which option is better, because every employer is a unique entity, and one solution may not suit everyone.
Dajana Csongradyova, Partner, Nitschneider & Partners
